Shiton Ransomware

The Shiton Ransomware is yet another crypt locker threat that uses VoidCrypt Ransomware as its basis. Being a simple variant means that it is nearly identical to VoidCrypt without any major modification being added to the code. The aspects that distinguish Shiton from other ransomware threats from the VoidCrypt Ransomware malware family are the email address provided as communication channels and the specific extension used to mark the encryption files. 

When the Shiton Ransomware encrypts a file, it proceeds to change its original name significantly. The threat append the email address 'Ad.Decrypt01@Gmail.com,' followed by a string of characters representing the unique ID for the particular victim, and finally '.shiton' as a new file extension. The ransom note with instructions for the victims is dropped as text files named '!INFO.HTA' that are placed in every folder containing encrypted files.  

In the note, the criminals do not specify the exact amount they want to receive for the restoration of the user's files. They do clarify that the payment must be made in Bitcoin. The hackers also threaten that the price will be increased if 48 hours pass without the victim initiating contact. To avoid it, users should send a message to the main email address at 'Ad.Decrypt01@Gmail.com,' and if they do not receive an answer, to the alternate email at 'AdminDecrypt02@ProtonMail.com.' 

The ransom note delivered by the Shiton Ransomware is:

'!!! Your Files Has Been Encrypted !!!

♦ your files has been locked with highest secure cryptography algorithm ♦

♦ there is no way to decrypt your files without paying and buying Decryption tool♦

♦ but after 48 hour decryption price will be double♦

♦ you can send some little files for decryption test♦

♦ test file should not contain valuable data♦

♦ after payment you will get decryption tool ( payment Should be with Bitcoin)♦

♦ so if you want your files dont be shy feel free to contact us and do an agreement on price♦

♦ !!! or Delete you files if you dont need them !!!

♦Your ID :-

our Email :Ad.Decrypt01@Gmail.com

In Case Of No Answer :AdminDecrypt02@ProtonMail.com.'